Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Submission Details
Severity: medium
Valid

Merkle leaf uses the live Snow balance, so a 1 wei transfer or normal farming makes valid claims revert

prasadreddy

Root + Impact

`claimSnowman` rebuilds the Merkle leaf from `i_snow.balanceOf(receiver)` at claim time instead of using an amount committed in the tree. Any change to a recipient's Snow balance, whether from earning, buying or a dust transfer from an attacker, makes the proof invalid. An attacker can block any recipient's claim for 1 wei of Snow, and honest users who farm as the protocol instructs lose eligibility.

Description

  • A Merkle airdrop commits (recipient, amount) pairs into an immutable root, so the amount a user can claim is fixed when the tree is built.

  • Here the amount is read from the receiver’s current Snow balance, which anyone can change by transferring Snow, so the recomputed leaf stops matching the committed one.

// Root cause in the codebase with @> marks to highlight the relevant section
// src/SnowmanAirdrop.sol (verify line numbers against the repo)
function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant {
...
// @> Amount comes from the live balance, which anyone can change by transferring Snow
uint256 amount = i_snow.balanceOf(receiver);
​
// @> Leaf is rebuilt from that live balance instead of a committed amount
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
​
// @> Reverts as soon as the balance differs from the one committed in the tree
if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) {
revert SA__InvalidProof();
}
...
}

Risk

Likelihood:

  • Snow is freely transferable and free to earn every week, so anyone can change another address’s balance.

  • A recipient who farms after the tree is built, as the README tells users to, changes their own balance.

Impact:

  • An attacker can block any eligible user’s claim for 1 wei of Snow, and can repeat it after the victim moves the dust.

  • Honest users who earn or buy Snow after the snapshot lose their claim.

Proof of Concept
The test below uses the repo's `TestSnowmanAirdrop` setup, where `alice` is in the Merkle tree with a balance of 1. An attacker transfers 1 wei of Snow to `alice`, so her balance becomes 2 and the recomputed leaf no longer matches the committed one. Alice's valid proof and signature then revert with `SA__InvalidProof`. Run it with `forge test --match-test test_dustTransferBlocksClaim -vvv`.

## Proof of Concept
​
```solidity
// Explanation: alice is in the Merkle tree with balance 1. The attacker sends
// 1 wei of Snow to alice, so her live balance becomes 2 and the recomputed
// leaf no longer matches the committed one. Her valid claim then reverts.
function test_dustTransferBlocksClaim() public {
bytes32 digest = airdrop.getMessageHash(alice);
(uint8 v, bytes32 r, bytes32 s) = vm.sign(alKey, digest);
​
vm.startPrank(attacker);
snow.earnSnow();
snow.transfer(alice, 1);
vm.stopPrank();
​
vm.prank(alice);
snow.approve(address(airdrop), type(uint256).max);
​
vm.expectRevert(SnowmanAirdrop.SA__InvalidProof.selector);
airdrop.claimSnowman(alice, AL_PROOF, v, r, s);
}
```
​
The test passes: a 1 wei dust transfer makes alice's valid claim revert with `SA__InvalidProof`. Run it with `forge test --match-test test_dustTransferBlocksClaim -vvv`.

Recommended Mitigation

Use an amount that is fixed in the tree instead of the live balance. Take amount as a claim parameter, verify the leaf with that amount, and check that the receiver holds at least that much Snow. Add a s_hasClaimedSnowman check so each leaf can only be used once, and include the amount in the signed message.

- function claimSnowman(address receiver, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant {
+ function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant {
+ if (s_hasClaimedSnowman[receiver]) revert SA__AlreadyClaimed();
...
- uint256 amount = i_snow.balanceOf(receiver);
bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount))));
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] DoS to a user trying to claim a Snowman

# Root + Impact ## Description * Users will approve a specific amount of Snow to the SnowmanAirdrop and also sign a message with their address and that same amount, in order to be able to claim the NFT * Because the current amount of Snow owned by the user is used in the verification, an attacker could forcefully send Snow to the receiver in a front-running attack, to prevent the receiver from claiming the NFT.  ```Solidity function getMessageHash(address receiver) public view returns (bytes32) { ... // @audit HIGH An attacker could send 1 wei of Snow token to the receiver and invalidate the signature, causing the receiver to never be able to claim their Snowman uint256 amount = i_snow.balanceOf(receiver); return _hashTypedDataV4( keccak256(abi.encode(MESSAGE_TYPEHASH, SnowmanClaim({receiver: receiver, amount: amount}))) ); ``` ## Risk **Likelihood**: * The attacker must purchase Snow and forcefully send it to the receiver in a front-running attack, so the likelihood is Medium **Impact**: * The impact is High as it could lock out the receiver from claiming forever ## Proof of Concept The attack consists on Bob sending an extra Snow token to Alice before Satoshi claims the NFT on behalf of Alice. To showcase the risk, the extra Snow is earned for free by Bob. ```Solidity function testDoSClaimSnowman() public { assert(snow.balanceOf(alice) == 1); // Get alice's digest while the amount is still 1 bytes32 alDigest = airdrop.getMessageHash(alice); // alice signs a message (uint8 alV, bytes32 alR, bytes32 alS) = vm.sign(alKey, alDigest); vm.startPrank(bob); vm.warp(block.timestamp + 1 weeks); snow.earnSnow(); assert(snow.balanceOf(bob) == 2); snow.transfer(alice, 1); // Alice claim test assert(snow.balanceOf(alice) == 2); vm.startPrank(alice); snow.approve(address(airdrop), 1); // satoshi calls claims on behalf of alice using her signed message vm.startPrank(satoshi); vm.expectRevert(); airdrop.claimSnowman(alice, AL_PROOF, alV, alR, alS); } ``` ## Recommended Mitigation Include the amount to be claimed in both `getMessageHash` and `claimSnowman` instead of reading it from the Snow contract. Showing only the new code in the section below ```Python function claimSnowman(address receiver, uint256 amount, bytes32[] calldata merkleProof, uint8 v, bytes32 r, bytes32 s) external nonReentrant { ... bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(receiver, amount)))); if (!MerkleProof.verify(merkleProof, i_merkleRoot, leaf)) { revert SA__InvalidProof(); } // @audit LOW Seems like using the ERC20 permit here would allow for both the delegation of the claim and the transfer of the Snow tokens in one transaction i_snow.safeTransferFrom(receiver, address(this), amount); // send ... } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!